$ gpg --list-keys
Everything we publish is signed. With these public keys you can check that a package or a repository is authentic and has not been tampered with.
Build key: the signature of each file
Every package (.deb, .rpm and AppImage) is signed when it is built, with a key that never leaves the build machine. Its signature (.asc) proves the file is the one we published and that nobody modified it.
Fingerprint:
7B07 667D 0956 6D00 8850 97E0 CF65 15A3 0E5D 0F1FTo verify a downloaded file, import the key once and check its signature:
$ curl -fsSL https://cheshirekat.com.ar/keys/cheshirekat-release.asc | gpg --import
$ gpg --verify file.asc fileRepository key: the signature of the indexes
The APT and RPM repositories sign their indexes with this key. apt, dnf and zypper use it automatically to verify every update; each app's install commands already set it up.
Fingerprint:
EA33 E49A 099E C401 17EB 7E1D 8088 6602 7CFE D1B2If you import it by hand, check that the fingerprint matches the one above.